CVE-2018-16197

Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier allows an attacker on the same network segment to bypass access restriction to access the information and files stored on the affected device.

CVSS v3 6.5 MEDIUM
CVSS v2.0 3.3 LOW

6.5^/10

CVSS v3 : MEDIUM

Vector : AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability : 2.8 / Impact : 3.6

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

3.3^/10

CVSS v2.0 : LOW

Vector : AV:A/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 6.5 / Impact : 2.9

Access Vector ADJACENT_NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www.tlt.co.jp/tlt/information/seihin/notice/defect/20181219/20181219.htm	Vendor Advisory
https://jvn.jp/en/jp/JVN99810718/index.html	Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:toshiba:hem-gw16a_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:toshiba:hem-gw16a:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:toshiba:hem-gw26a_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:toshiba:hem-gw26a:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2019-01-09 23:29

Updated : 2023-12-10 12:44

NVD link : CVE-2018-16197

Mitre link : CVE-2018-16197

CVE.ORG link : CVE-2018-16197

JSON object : View

Products Affected

toshiba

hem-gw16a
hem-gw26a
hem-gw16a_firmware
hem-gw26a_firmware

CWE

NVD-CWE-noinfo

{"id": "CVE-2018-16197", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.3, "accessVector": "ADJACENT_NETWORK", "vectorString": "AV:A/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.5, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2019-01-09T23:29:04.623", "references": [{"url": "http://www.tlt.co.jp/tlt/information/seihin/notice/defect/20181219/20181219.htm", "tags": ["Vendor Advisory"], "source": "vultures@jpcert.or.jp"}, {"url": "https://jvn.jp/en/jp/JVN99810718/index.html", "tags": ["Third Party Advisory"], "source": "vultures@jpcert.or.jp"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier allows an attacker on the same network segment to bypass access restriction to access the information and files stored on the affected device."}, {"lang": "es", "value": "La puerta de enlace Toshiba Home HEM-GW16A, en versiones 1.2.9 y anteriores, y la puerta de enlace Toshiba Home HEM-GW26A, en versiones 1.2.9 y anteriores, permiten que un atacante en el mismo segmento de red omita las restricciones de acceso para acceder a la informaci\u00f3n y los archivos almacenados en el dispositivo afectado."}], "lastModified": "2019-10-03T00:03:26.223", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:toshiba:hem-gw16a_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9E768A13-4373-4211-9D77-6D02BC377EC9", "versionEndIncluding": "1.2.9"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:toshiba:hem-gw16a:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "6D9C8238-D8C8-46CD-993F-3A49C1627BE1"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:toshiba:hem-gw26a_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "59EC2236-60EA-4E49-A337-D32EAE51FDED", "versionEndIncluding": "1.2.9"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:toshiba:hem-gw26a:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "1D699E38-BB97-4831-B5BF-E1DF1735ABEB"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "vultures@jpcert.or.jp"}